#vs-code-extensions

Analysis · Jun 3, 2026 · Colten Anderson

Three CVEs keep getting called the Nx attack, and only one of them is this one

An 18-minute window on the VS Code marketplace ended with 3,800 of GitHub's own repositories copied. The interesting part isn't the speed. It's the delivery channel nobody was watching.